ack-pod-identity-webhook

组件介绍

ack-pod-identity-webhook组件的架构图如下所示。

使用示例

本示例部署的应用中，将使用RRSA特性扮演指定角色获取当前账号下集群列表信息。相关信息如下。

• 命名空间：rrsa-demo

• 服务账户：demo-sa

• RAM角色：ack-pod-identity-webhook-demo

当为Pod所在命名空间增加pod-identity.alibabacloud.com/injection: 'on'标签后，ack-pod-identity-webhook组件将根据Pod使用的服务账号的注解配置，自动为该Pod注入相关配置项。使用示例的操作步骤如下。

1. 为集群开启RRSA功能。

   1. 登录容器计算服务控制台，在左侧导航栏选择集群列表。

   2. 在集群列表页面，单击目标集群名称，然后在左侧导航栏，选择集群信息。

   3. 在集群信息页面，单击基本信息页签，然后在安全与审计区域单击RRSA OIDC后的开启。

   4. 在弹出的启用 RRSA对话框，单击确定。

      说明

      • RRSA功能启用大约需要2-3min的时间，若遇到集群状态一直处于更新中的情况，请手动点击页面右上角的按钮手动刷新。

      • 当集群状态由更新中变为运行中后，表明该集群的RRSA特性已变更完成。将鼠标移动到RRSA OIDC右侧的已开启上，将显示OIDC提供商的URL链接和ARN信息。

2. 安装ack-pod-identity-webhook组件。

   1. 在左侧导航栏，选择运维管理 > 组件管理。

   2. 单击安全页签，找到ack-pod-identity-webhook组件，单击安装。

   3. 在提示对话框确认组件信息后，单击确认。

3. 创建一个名为ack-pod-identity-webhook-demo的RAM角色。

   1. 使用阿里云账号登录RAM控制台。

   2. 在左侧导航栏，选择身份管理 > 角色，然后在Role页面，单击创建角色。

   3. 在创建角色面板，单击切换编辑器来创建角色。

   4. 以可视化编辑为例，参考如下角色信息进行配置，然后单击确定。

      配置项	描述
      效果	默认为允许。
      主体	选择身份提供者后，点击编辑。 选择身份提供者类型为OIDC，然后选择对应集群的身份提供者，如ack-rrsa-<cluster_id>。其中<cluster_id>为集群ID。
      操作	默认勾选sts:AssumeRole。
      条件	oidc:iss：选择身份提供者后自动添加，保持默认。 oidc:aud：选择身份提供者后自动添加，保持默认。 oidc:sub：需要手动添加条件。 条件键：oidc:sub 运算符：StringEquals 条件值：格式为system:serviceaccount:<namespace>:<serviceAccountName>。 <namespace>：应用所在的命名空间。 <serviceAccountName>：服务账户名称。 根据测试应用的信息，此处需要填入system:serviceaccount:rrsa-demo:demo-sa。

   5. 在弹窗页面中，输入角色名称ack-pod-identity-webhook-demo，单击确定。

4. 为上一步创建的RAM角色授予测试应用所需的AliyunCSReadOnlyAccess系统策略权限。具体操作，请参见管理RAM角色的权限。

5. 部署测试应用。

   1. 连接集群。具体操作，请参见连接集群。

   2. 使用以下内容，创建demo.yaml文件。

      如下YAML示例中，为命名空间rrsa-demo增加标签pod-identity.alibabacloud.com/injection: 'on'，并为服务账号demo-sa增加注解pod-identity.alibabacloud.com/role-name: ack-pod-identity-webhook-demo，启用ack-pod-identity-webhook组件的自动配置注入功能。关于RRSA Demo调用的具体实现，请参见代码。

      说明

      以下示例使用的registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0需通过公网拉取，请确保集群已开通公网访问。具体操作，请参见为集群开启公网访问能力。

      ---
      apiVersion: v1
      kind: Namespace
      metadata:
        name: rrsa-demo
        labels:
          pod-identity.alibabacloud.com/injection: 'on'
      ---
      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: demo-sa
        namespace: rrsa-demo
        annotations:
          pod-identity.alibabacloud.com/role-name: ack-pod-identity-webhook-demo
      ---
      apiVersion: v1
      kind: Pod
      metadata:
        name: demo
        namespace: rrsa-demo
      spec:
        serviceAccountName: demo-sa
        containers:
          - image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0 
            imagePullPolicy: "Always"
            args:
              - rrsa
              - demo
            name: demo
        restartPolicy: OnFailure

   3. 部署测试应用。

      kubectl apply -f demo.yaml

6. 查看测试应用Pod，确认ack-pod-identity-webhook组件已为Pod自动注入所需的配置。

   kubectl -n rrsa-demo get pod demo -o yaml

   展开查看预期输出

   apiVersion: v1
   kind: Pod
   metadata:
     annotations:
       ProviderCreate: done
       alibabacloud.com/client-token: 5e68e5bf-1726-4f5e-****-abe61d2c1cff
       alibabacloud.com/instance-id: acs-uf6008givz63ta2v****
       alibabacloud.com/pod-ephemeral-storage: 30Gi
       alibabacloud.com/pod-use-spec: 0.25-0.5Gi
       alibabacloud.com/request-id: 5914A73F-8B24-5B9B-****-400F6B632D44
       alibabacloud.com/schedule-result: finished
       alibabacloud.com/user-id: "1488999589******"
       kubectl.kubernetes.io/last-applied-configuration: |
         {"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"name":"demo","namespace":"rrsa-demo"},"spec":{"containers":[{"args":["rrsa","demo"],"image":"registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0","imagePullPolicy":"Always","name":"demo"}],"restartPolicy":"OnFailure","serviceAccountName":"demo-sa"}}
       kubernetes.io/pod-stream-port: "10250"
       kubernetes.io/preferred-scheduling-node: virtual-kubelet-cn-shanghai-g/1
       network.alibabacloud.com/allocated-eni-id: eni-uf6fhxwakz5b0d******
       network.alibabacloud.com/enable-dns-cache: "false"
       network.alibabacloud.com/security-group-id: sg-uf60h6mbwry22r******
       network.alibabacloud.com/security-group-ids: sg-uf60h6mbwry22r******
       network.alibabacloud.com/vpc-id: vpc-uf6ncu6tpunqchrrr****
       network.alibabacloud.com/vswitch-id: vsw-uf6g4yjk3kemgei******
       network.alibabacloud.com/vswitch-ids: vsw-uf6g4yjk3kemgei******
       topology.kubernetes.io/region: cn-shanghai
       topology.kubernetes.io/zone: cn-shanghai-g
     creationTimestamp: "2024-08-19T09:29:57Z"
     labels:
       alibabacloud.com/cluster-id: cbec9a1f7b433470ebe4c900552******
       alibabacloud.com/compute-class: general-purpose
       alibabacloud.com/compute-qos: default
       topology.kubernetes.io/region: cn-shanghai
     name: demo
     namespace: rrsa-demo
     resourceVersion: "6795900"
     uid: 57ab5f1d-32b7-4d9d-****-16a4f2c1a1fa
   spec:
     containers:
     - args:
       - rrsa
       - demo
       env:
       - name: ALIBABA_CLOUD_ROLE_ARN
         value: acs:ram::1488999589******:role/ack-pod-identity-webhook-demo
       - name: ALIBABA_CLOUD_OIDC_PROVIDER_ARN
         value: acs:ram::1488999589******:oidc-provider/ack-rrsa-cbec9a1f7b433470ebe4c900552******
       - name: ALIBABA_CLOUD_OIDC_TOKEN_FILE
         value: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens/token
       - name: KUBERNETES_SERVICE_HOST
         value: 192.168.1.215
       - name: KUBERNETES_SERVICE_PORT
         value: "6443"
       image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0
       imagePullPolicy: Always
       name: demo
       resources:
         limits:
           cpu: 250m
           ephemeral-storage: 30Gi
           memory: 512Mi
         requests:
           cpu: 250m
           ephemeral-storage: 30Gi
           memory: 512Mi
       terminationMessagePath: /dev/termination-log
       terminationMessagePolicy: File
       volumeMounts:
       - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
         name: kube-api-access-lrcfl
         readOnly: true
       - mountPath: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens
         name: rrsa-oidc-token
         readOnly: true
     dnsPolicy: ClusterFirst
     enableServiceLinks: true
     nodeName: virtual-kubelet-cn-shanghai-g
     preemptionPolicy: PreemptLowerPriority
     priority: 0
     restartPolicy: OnFailure
     schedulerName: default-scheduler
     securityContext: {}
     serviceAccount: demo-sa
     serviceAccountName: demo-sa
     terminationGracePeriodSeconds: 30
     tolerations:
     - effect: NoExecute
       key: node.kubernetes.io/not-ready
       operator: Exists
     - effect: NoExecute
       key: node.kubernetes.io/unreachable
       operator: Exists
     volumes:
     - name: kube-api-access-lrcfl
       projected:
         defaultMode: 420
         sources:
         - serviceAccountToken:
             expirationSeconds: 3607
             path: token
         - configMap:
             items:
             - key: ca.crt
               path: ca.crt
             name: kube-root-ca.crt
         - downwardAPI:
             items:
             - fieldRef:
                 apiVersion: v1
                 fieldPath: metadata.namespace
               path: namespace
     - name: rrsa-oidc-token
       projected:
         defaultMode: 420
         sources:
         - serviceAccountToken:
             audience: sts.aliyuncs.com
             expirationSeconds: 3600
             path: token
   status:
     conditions:
     - lastProbeTime: null
       lastTransitionTime: "2024-08-19T09:29:57Z"
       message: The container instance is creating.
       reason: Creating
       status: "False"
       type: ContainerInstanceScheduled
     - lastProbeTime: null
       lastTransitionTime: "2024-08-19T09:30:10Z"
       status: "True"
       type: Initialized
     - lastProbeTime: null
       lastTransitionTime: "2024-08-19T09:30:13Z"
       status: "True"
       type: Ready
     - lastProbeTime: null
       lastTransitionTime: "2024-08-19T09:30:13Z"
       status: "True"
       type: ContainersReady
     - lastProbeTime: null
       lastTransitionTime: "2024-08-19T09:30:10Z"
       status: "True"
       type: ContainerHasSufficientDisk
     - lastProbeTime: null
       lastTransitionTime: "2024-08-19T09:30:12Z"
       status: "True"
       type: ContainerInstanceCreated
     - lastProbeTime: null
       lastTransitionTime: "2024-08-19T09:30:13Z"
       status: "True"
       type: PodReadyToStartContainers
     - lastProbeTime: null
       lastTransitionTime: "2024-08-19T09:30:12Z"
       status: "True"
       type: PodScheduled
     containerStatuses:
     - containerID: containerd://5d4f205e068372f30a90715016465562b9988a981cb285e81c76b5b0dc******
       image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0
       imageID: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool@sha256:ad4172d3ed3d6dab23f09218f9d478295e93c163915aac9e4e38a90c4d******
       lastState: {}
       name: demo
       ready: true
       restartCount: 0
       started: true
       state:
         running:
           startedAt: "2024-08-19T09:30:13Z"
     hostIP: 192.168.1.5
     phase: Running
     podIP: 192.168.1.5
     podIPs:
     - ip: 192.168.1.5
     qosClass: Guaranteed

   预期输出表明，ack-pod-identity-webhook组件已为Pod自动注入了如下配置。

   字段	配置项名称	配置项说明
   env	ALIBABA_CLOUD_ROLE_ARN	需要扮演的RAM角色ARN。
   	ALIBABA_CLOUD_OIDC_PROVIDER_ARN	OIDC身份提供商的ARN。
   	ALIBABA_CLOUD_OIDC_TOKEN_FILE	包含OIDC Token的文件路径。
   VolumeMounts	rrsa-oidc-token	挂载OIDC Token的配置。
   Volumes	rrsa-oidc-token	挂载OIDC Token的配置。

7. 查看测试应用日志。

   kubectl -n rrsa-demo logs demo

   预期输出：

   cluster id: c66e40b731ab24f96b36bec5b1a******, cluster name: test-****
   cluster id: cbec9a1f7b433470ebe4c900552******, cluster name: test-****

自定义配置

ack-pod-identity-webhook组件的自定义配置包括命名空间配置、服务账户配置以及Pod配置。

apiVersion: v1
kind: Namespace
metadata:
  name: test
  labels:
    pod-identity.alibabacloud.com/injection: 'on'

apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/role-name: test-role

apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/service-account-token-expiration: '3600'

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/service-account-token-expiration: '3600'

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/only-containers: 'controller,test'

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/skip-containers: 'controller,test'

RRSA SDK参考代码

变更记录